huntrule

Windows Procdump Process Execution

Alerts on execution of Sysinternals Procdump (32/64 variants) based on process creation image path.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-08-16
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion → Cred Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation events where the executable path ends with procdump variants (procdump.exe, procdump64.exe, procdump64a.exe). Procdump is commonly used to capture process memory, which can be used to extract sensitive data and credentials from running processes. The detection relies on Windows process creation telemetry, specifically the process image name in each event.

Reporting behind it

Related detections9 linkedT1036 — drag to rearrange
Windows Process Creation: Renamed createdump.exe Used for .dmp Memory Dumps
Windows: Detect DumpMinitool.exe Execution for Process Memory Dumping
Windows: Detect Suspicious DumpMinitool.exe Execution via Process Command-Line
Windows: Detect XORDump Utility Launch With LSASS Dump and Debug Module Switches
Windows ProcDump renamed, copied or moved for stealth evasion
Windows Process Creation: createdump.exe Dumping Memory with Full and Name Flags
Windows Process Memory Dump via comsvcs.dll using rundll32
Windows ProcDump Command Lines Targeting LSASS Memory Dumps
Malicious DLL Execution With Non Standard Extension via rundll32
Windows Procdump Process Execution
Pivot detection · T1036 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.